undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
2026-03-26 17:11:57 -04:00 · 2026-03-26 17:11:57 -04:00 · 0a580b313d
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
--- a/make/modules/java.base/gendata/GendataBlockedCerts.gmk
+++ b/make/modules/java.base/gendata/GendataBlockedCerts.gmk
@ -0,0 +1,44 @@
+#
+# Copyright (c) 2014, 2025, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+include MakeIncludeStart.gmk
+ifeq ($(INCLUDE), true)
+
+################################################################################
+
+GENDATA_BLOCKED_CERTS_SRC += $(MODULE_SRC)/share/data/blockedcertsconverter/blocked.certs.pem
+GENDATA_BLOCKED_CERTS := $(SUPPORT_OUTPUTDIR)/modules_libs/$(MODULE)/security/blocked.certs
+
+$(GENDATA_BLOCKED_CERTS): $(BUILD_TOOLS_JDK) $(GENDATA_BLOCKED_CERTS_SRC)
+	$(call LogInfo, Generating blocked certs)
+	$(call MakeDir, $(@D))
+	($(CAT) $(GENDATA_BLOCKED_CERTS_SRC) | $(TOOL_BLOCKED_CERTS) > $@) || exit 1
+
+TARGETS += $(GENDATA_BLOCKED_CERTS)
+
+################################################################################
+
+endif # include guard
+include MakeIncludeEnd.gmk
--- a/make/modules/java.base/gendata/GendataBreakIterator.gmk
+++ b/make/modules/java.base/gendata/GendataBreakIterator.gmk
@ -0,0 +1,121 @@
+
+# Copyright (c) 2011, 2025, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+include MakeIncludeStart.gmk
+ifeq ($(INCLUDE), true)
+
+################################################################################
+# Make file for generating BreakIterator data files.
+################################################################################
+
+# input
+#
+# Notes: sun.text.resources.BreakIteratorRules no longer goes to runtime.
+# They are used at JDK build phase in order to create $(BIFILES) which
+# are used on runtime instead.
+#
+TEXT_PKG := sun/text/resources
+TEXT_PKG_LD := $(TEXT_PKG)/ext
+TEXT_SOURCES := $(TEXT_PKG)/BreakIteratorRules.java \
+    $(TEXT_PKG)/BreakIteratorInfo.java \
+    $(TEXT_PKG_LD)/BreakIteratorRules_th.java \
+    $(TEXT_PKG_LD)/BreakIteratorInfo_th.java
+
+# Generate BreakIteratorData
+BREAK_ITERATOR_CLASSES := $(BUILDTOOLS_OUTPUTDIR)/break_iterator_classes
+
+# These two files should be moved out to a build tool!
+$(eval $(call SetupJavaCompilation, BUILD_BREAKITERATOR_BASE, \
+    TARGET_RELEASE := $(TARGET_RELEASE_BOOTJDK), \
+    SRC := $(TOPDIR)/src/java.base/share/classes, \
+    INCLUDE_FILES := \
+        $(TEXT_PKG)/BreakIteratorRules.java \
+        $(TEXT_PKG)/BreakIteratorInfo.java, \
+    BIN := $(BREAK_ITERATOR_CLASSES)/java.base, \
+    DISABLED_WARNINGS := options, \
+))
+
+$(eval $(call SetupJavaCompilation, BUILD_BREAKITERATOR_LD, \
+    TARGET_RELEASE := $(TARGET_RELEASE_BOOTJDK), \
+    SRC := $(TOPDIR)/src/jdk.localedata/share/classes, \
+    INCLUDE_FILES := \
+        $(TEXT_PKG_LD)/BreakIteratorRules_th.java \
+        $(TEXT_PKG_LD)/BreakIteratorInfo_th.java, \
+    BIN := $(BREAK_ITERATOR_CLASSES)/jdk.localedata, \
+    DISABLED_WARNINGS := options, \
+))
+
+BREAK_ITERATOR_BOOTCLASSPATH := \
+    --patch-module java.base=$(BREAK_ITERATOR_CLASSES)/java.base \
+    --patch-module jdk.localedata=$(BREAK_ITERATOR_CLASSES)/jdk.localedata \
+    --add-exports java.base/sun.text=ALL-UNNAMED \
+    --add-exports java.base/sun.text.resources=ALL-UNNAMED \
+    --add-exports jdk.localedata/sun.text.resources.ext=ALL-UNNAMED \
+    #
+
+# Generate data resource files.
+# input
+UNICODEDATA := $(MODULE_SRC)/share/data/unicodedata/UnicodeData.txt
+
+# output
+BASE_DATA_PKG_DIR := $(JDK_OUTPUTDIR)/modules/java.base/sun/text/resources
+LD_DATA_PKG_DIR := $(JDK_OUTPUTDIR)/modules/jdk.localedata/sun/text/resources/ext
+BIFILES := $(BASE_DATA_PKG_DIR)/CharacterBreakIteratorData \
+    $(BASE_DATA_PKG_DIR)/WordBreakIteratorData \
+    $(BASE_DATA_PKG_DIR)/LineBreakIteratorData \
+    $(BASE_DATA_PKG_DIR)/SentenceBreakIteratorData
+BIFILES_TH := $(LD_DATA_PKG_DIR)/WordBreakIteratorData_th \
+    $(LD_DATA_PKG_DIR)/LineBreakIteratorData_th
+
+$(BIFILES): $(BASE_DATA_PKG_DIR)/_the.bifiles
+$(BASE_DATA_PKG_DIR)/_the.bifiles: JAVA_FLAGS += $(BREAK_ITERATOR_BOOTCLASSPATH)
+$(BASE_DATA_PKG_DIR)/_the.bifiles: $(BUILD_TOOLS_JDK) $(UNICODEDATA) \
+    $(BUILD_BREAKITERATOR_BASE) $(BUILD_BREAKITERATOR_LD)
+	$(call LogInfo, Generating BreakIteratorData)
+	$(call MakeDir, $(@D))
+	$(RM) $(BIFILES)
+	$(TOOL_GENERATEBREAKITERATORDATA) \
+	    -o $(@D) \
+	    -spec $(UNICODEDATA)
+	$(TOUCH) $@
+
+$(BIFILES_TH): $(LD_DATA_PKG_DIR)/_the.bifiles_th
+$(LD_DATA_PKG_DIR)/_the.bifiles_th: JAVA_FLAGS += $(BREAK_ITERATOR_BOOTCLASSPATH)
+$(LD_DATA_PKG_DIR)/_the.bifiles_th: $(BUILD_TOOLS_JDK) $(UNICODEDATA) \
+    $(BUILD_BREAKITERATOR_BASE) $(BUILD_BREAKITERATOR_LD)
+	$(call LogInfo, Generating BreakIteratorData_th)
+	$(RM) $(BIFILES_TH)
+	$(TOOL_GENERATEBREAKITERATORDATA) \
+	    -o $(@D) \
+	    -spec $(UNICODEDATA) \
+	    -language th
+	$(TOUCH) $@
+
+TARGETS += $(BIFILES) $(BIFILES_TH)
+
+################################################################################
+
+endif # include guard
+include MakeIncludeEnd.gmk
--- a/make/modules/java.base/gendata/GendataCryptoPolicy.gmk
+++ b/make/modules/java.base/gendata/GendataCryptoPolicy.gmk
@ -0,0 +1,74 @@
+#
+# Copyright (c) 2013, 2025, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+include MakeIncludeStart.gmk
+ifeq ($(INCLUDE), true)
+
+################################################################################
+
+#
+# In pre-JDK9 releases, Oracle JDK has had a separately downloadable set
+# of policy files which has been a nightmare for deployment.
+#
+# We now create 2 complete initial sets of policy files and package into
+# 2 different directories.  The crypto.policy Security property will select
+# the active policy.
+#
+# It will be up to the user/deployer to make an informed choice
+# as to whether they are legally entitled to use the unlimited policy
+# file in their environment.  The $(UNLIMITED_CRYPTO) make variable
+# determines the default directory/policy.
+#
+
+################################################################################
+POLICY_DIR := $(SUPPORT_OUTPUTDIR)/modules_conf/java.base/security/policy
+LIMITED_POLICY_DIR := $(POLICY_DIR)/limited
+UNLIMITED_POLICY_DIR := $(POLICY_DIR)/unlimited
+
+POLICY_SRC_DIR := $(TOPDIR)/src/java.base/share/conf/security/policy
+LIMITED_POLICY_SRC_DIR := $(POLICY_SRC_DIR)/limited
+UNLIMITED_POLICY_SRC_DIR := $(POLICY_SRC_DIR)/unlimited
+
+$(POLICY_DIR)/README.txt: $(POLICY_SRC_DIR)/README.txt
+	$(install-file)
+
+$(LIMITED_POLICY_DIR)/%: $(LIMITED_POLICY_SRC_DIR)/%
+	$(install-file)
+
+$(UNLIMITED_POLICY_DIR)/%: $(UNLIMITED_POLICY_SRC_DIR)/%
+	$(install-file)
+
+TARGETS += \
+    $(POLICY_DIR)/README.txt \
+    $(LIMITED_POLICY_DIR)/default_US_export.policy \
+    $(LIMITED_POLICY_DIR)/default_local.policy \
+    $(LIMITED_POLICY_DIR)/exempt_local.policy \
+    $(UNLIMITED_POLICY_DIR)/default_US_export.policy \
+    $(UNLIMITED_POLICY_DIR)/default_local.policy \
+
+################################################################################
+
+endif # include guard
+include MakeIncludeEnd.gmk
--- a/make/modules/java.base/gendata/GendataPublicSuffixList.gmk
+++ b/make/modules/java.base/gendata/GendataPublicSuffixList.gmk
@ -0,0 +1,46 @@
+#
+# Copyright (c) 2017, 2025, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+include MakeIncludeStart.gmk
+ifeq ($(INCLUDE), true)
+
+################################################################################
+
+GENDATA_PUBLICSUFFIXLIST_SRC += $(MODULE_SRC)/share/data/publicsuffixlist/public_suffix_list.dat
+GENDATA_PUBLICSUFFIXLIST := $(SUPPORT_OUTPUTDIR)/modules_libs/$(MODULE)/security/public_suffix_list.dat
+
+$(GENDATA_PUBLICSUFFIXLIST): $(GENDATA_PUBLICSUFFIXLIST_SRC) $(BUILD_TOOLS_JDK)
+	$(call LogInfo, Generating public suffix list)
+	$(call MakeDir, $(@D))
+	$(RM) $@
+	$(TOOL_PUBLICSUFFIXLIST) $< $@
+	$(CHMOD) 444 $@
+
+TARGETS += $(GENDATA_PUBLICSUFFIXLIST)
+
+################################################################################
+
+endif # include guard
+include MakeIncludeEnd.gmk
--- a/make/modules/java.base/gendata/GendataTZDB.gmk
+++ b/make/modules/java.base/gendata/GendataTZDB.gmk
@ -0,0 +1,52 @@
+#
+# Copyright (c) 2012, 2025, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+include MakeIncludeStart.gmk
+ifeq ($(INCLUDE), true)
+
+################################################################################
+
+GENDATA_TZDB :=
+
+#
+# Time zone data file creation
+#
+TZDATA_DIR := $(MODULE_SRC)/share/data/tzdata
+TZDATA_TZFILE := africa antarctica asia australasia europe northamerica southamerica backward etcetera gmt jdk11_backward
+TZDATA_TZFILES := $(wildcard $(TZDATA_DIR)/*)
+
+GENDATA_TZDB_DAT := $(SUPPORT_OUTPUTDIR)/modules_libs/$(MODULE)/tzdb.dat
+
+$(GENDATA_TZDB_DAT): $(TZDATA_TZFILES)
+	$(call MakeTargetDir)
+	$(RM) $(GENDATA_TZDB_DAT)
+	$(TOOL_TZDB) -srcdir $(TZDATA_DIR) -dstfile $(GENDATA_TZDB_DAT) $(TZDATA_TZFILE)
+
+TARGETS += $(GENDATA_TZDB_DAT)
+
+################################################################################
+
+endif # include guard
+include MakeIncludeEnd.gmk